developer-cli deploy fail to add redirect uris for ACA easy auth

[thiagolunardi]

Contact Details

No response

Bug description

What happens?
When I run pp deploy with a configured custom domain for the back-office app, the logs say the app registration for the back-office was successfully configured, but it actually fails, as no redirect URI is visible in the Azure Portal and Bad Request errors are displayed when running with the --trace option.

Steps to reproduce

1. existing deployed infra without custom domain in place
2. set the custom domain in the GitHub variables
3. run pp deploy --trace

Error messages or logs

Configuring Azure and GitHub ------------------------------------------------------------------

az provider register --namespace Microsoft.ContainerService --subscription aaa-bbb-ccc-ddd-eee
az provider register --namespace Microsoft.ContainerService --subscription aaa-bbb-ccc-ddd-eee
Successfully ensured deployment of Azure Container Apps Environment is enabled on Azure Subscriptions.
az containerapp env show --subscription "aaa-bbb-ccc-ddd-eee" --resource-group xxxx-stage-eu --name abcd-stage-eu --query properties.defaultDomain -o tsv
az containerapp env show --subscription "aaa-bbb-ccc-ddd-eee" --resource-group
abcd-prod-eu --name abcd-prod-eu --query properties.defaultDomain -o tsv
az ad app show --id aaa-bbb-ccc-ddd-eee --query id -o tsv
az rest --method GET --url 
"https://graph.microsoft.com/v1.0/applications/aaa-bbb-ccc-ddd-eee" -o json
az ad app show --id aaa-bbb-ccc-ddd-eee --query id -o tsv
az rest --method GET --url 
"https://graph.microsoft.com/v1.0/applications/aaa-bbb-ccc-ddd-eee" -o json
az  rest --method PATCH --url 
"https://graph.microsoft.com/v1.0/applications/aaa-bbb-ccc-ddd-eee" --body @-

Bad Request({"error":{"code":"Request_BadRequest","message":"Invalid value specified for property 'web' of resource 'Application'.","details": {"code":"InvalidValue","message":"Invalid value specified for property 'web' of resource Application'.","target":"web","blockedWord":"","prefix":"","suffix":""}],"innerError":{"date":"2026-08-20T21:41:09","request-id":"d87cf857-dd9a-4a5b-84f8-95c7ec5d2e9e","client-request-id":"d87cf857-dd9a-4a5b-84f8-95c7ec5d2e9e"}}})

Configured App Registration 'BackOffice - Production - thiagolunardi/my-own-app' for ACA Easy Auth
(ID token issuance + reply URLs + group claims).
az ad app federated-credential list --id aaa-bbb-ccc-ddd-eee -o json
az ad app federated-credential list --id aaa-bbb-ccc-ddd-eee -o json
Successfully created App Registration with Federated Credentials allowing passwordless 
deployments from https://github.com/thiagolunardi/my-own-app.

Workaround

Adding the redirect URI manually in the Azure Portal and enabling ID tokens (used for implicit and hybrid flows)

Severity

Medium

Is this bug security related?

• This bug is related to security

Code of Conduct

• I agree to follow this project's Code of Conduct

[linear]

PP-1337